@undefineds.co/xpod 0.4.15 → 0.4.16

package/dist/api/tasks/TaskAuthBinding.js

@@ -4,6 +4,7 @@ exports.TaskAuthBindingService = exports.TASK_AUTH_CREDENTIAL_SERVICE = exports.
 exports.encodeClientCredentialsApiKey = encodeClientCredentialsApiKey;
 exports.parseClientCredentialsApiKey = parseClientCredentialsApiKey;
 const node_crypto_1 = require("node:crypto");
+const TaskCredentialStore_1 = require("./TaskCredentialStore");
 const AuthContext_1 = require("../auth/AuthContext");
 exports.TaskAuthBindingKind = {
     SOLID_CLIENT_CREDENTIALS: 'solid-client-credentials',
@@ -17,6 +18,7 @@ class TaskAuthBindingService {
     constructor(options) {
         this.repository = options.repository;
         this.buildContext = options.buildContext ?? this.defaultBuildContext;
+        this.taskCredentials = options.taskCredentials;
     }
     async createBinding(input, context) {
         const auth = this.solidAuthFromContext(context);
@@ -47,7 +49,23 @@ class TaskAuthBindingService {
         }
         return this.snapshotFromCredential(credential, context);
     }
+    /**
+     * Restore Pod access for an unattended run.
+     *
+     * A binding id that names a task-layer grant is resolved from there, so the Pod never has to
+     * hold the secret; anything else falls back to the stored credential for the migration period.
+     * Either way the run keeps the owner the binding names, not whoever happened to trigger it.
+     */
     async resolveRunContext(bindingId, context) {
+        const granted = await this.resolveTaskGrant(bindingId, context);
+        if (granted.outcome === 'resolved') {
+            return this.buildContext(granted.binding, granted.clientSecret, context);
+        }
+        if (granted.outcome === 'unusable') {
+            // The binding names a task-layer grant that no longer applies. Falling back to a stored
+            // credential here would resurrect access the user revoked.
+            return undefined;
+        }
         const credential = await this.repository.loadTaskAuthCredential(bindingId, context);
         if (!credential) {
             return undefined;
@@ -65,6 +83,45 @@ class TaskAuthBindingService {
         }
         return this.buildContext(snapshot, parsed.clientSecret, context);
     }
+    /**
+     * A task-layer grant whose reference is the binding id, when this deployment has one.
+     *
+     * The owner comes from the context the caller restored, never from the binding id, so a forged
+     * id cannot point somebody else's grant at this run.
+     */
+    async resolveTaskGrant(bindingId, context) {
+        if (!this.taskCredentials || !bindingId.startsWith(TaskCredentialStore_1.TASK_CREDENTIAL_REF_PREFIX)) {
+            return { outcome: 'not-a-grant' };
+        }
+        const webId = this.ownerFromContext(context);
+        if (!webId) {
+            return { outcome: 'unusable' };
+        }
+        const credential = await this.taskCredentials.forRef({ credentialRef: bindingId, ownerWebId: webId });
+        if (!credential) {
+            return { outcome: 'unusable' };
+        }
+        return {
+            outcome: 'resolved',
+            clientSecret: credential.clientSecret,
+            binding: {
+                id: bindingId,
+                kind: exports.TaskAuthBindingKind.SOLID_CLIENT_CREDENTIALS,
+                webId,
+                clientId: credential.clientId,
+                status: exports.TaskAuthBindingStatus.ACTIVE,
+                createdAt: nowTimestamp(),
+            },
+        };
+    }
+    ownerFromContext(context) {
+        const auth = this.solidAuthFromContext(context);
+        if (auth?.webId) {
+            return auth.webId;
+        }
+        const userId = context.userId;
+        return typeof userId === 'string' && userId.length > 0 ? userId : undefined;
+    }
     snapshotFromCredential(credential, context) {
         if (credential.service !== exports.TASK_AUTH_CREDENTIAL_SERVICE) {
             throw new Error(`Credential is not a task auth credential: ${credential.id}`);

package/dist/api/tasks/TaskCredentialDatabase.d.ts

@@ -0,0 +1,23 @@
+import { taskCredentialSchema } from './TaskCredentialSchema';
+/** Which table layout a task-layer database handle uses. */
+export interface TaskCredentialDatabase {
+    db: any;
+    schema: typeof taskCredentialSchema.sqlite | typeof taskCredentialSchema.pg;
+}
+/**
+ * Where the task layer keeps its own credentials.
+ *
+ * An explicit URL wins. Otherwise a SQLite deployment gets a sibling file next to the identity
+ * database, so a leak of one store says nothing about the other. A PostgreSQL deployment keeps the
+ * same server for now: the deployment follow-up is a dedicated role or schema, which is a
+ * deployment decision rather than something to guess here.
+ */
+export declare function resolveTaskCredentialDatabaseUrl(input: {
+    identityDatabaseUrl: string;
+    configuredUrl?: string;
+}): string;
+/** Opens (once per URL) the task-layer database and makes sure its table exists. */
+export declare function getTaskCredentialDatabase(url: string): TaskCredentialDatabase;
+/** Test helper: forget cached handles so a fresh database can be opened at the same URL. */
+export declare function resetTaskCredentialDatabases(): void;
+export { taskCredentialSchema };

package/dist/api/tasks/TaskCredentialDatabase.js

@@ -0,0 +1,82 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.taskCredentialSchema = void 0;
+exports.resolveTaskCredentialDatabaseUrl = resolveTaskCredentialDatabaseUrl;
+exports.getTaskCredentialDatabase = getTaskCredentialDatabase;
+exports.resetTaskCredentialDatabases = resetTaskCredentialDatabases;
+const node_path_1 = __importDefault(require("node:path"));
+const node_postgres_1 = require("drizzle-orm/node-postgres");
+const global_logger_factory_1 = require("global-logger-factory");
+const SqliteRuntime_1 = require("../../storage/SqliteRuntime");
+const PostgresPoolManager_1 = require("../../storage/database/PostgresPoolManager");
+const db_1 = require("../../identity/drizzle/db");
+const TaskCredentialSchema_1 = require("./TaskCredentialSchema");
+Object.defineProperty(exports, "taskCredentialSchema", { enumerable: true, get: function () { return TaskCredentialSchema_1.taskCredentialSchema; } });
+const databaseCache = new Map();
+/**
+ * Where the task layer keeps its own credentials.
+ *
+ * An explicit URL wins. Otherwise a SQLite deployment gets a sibling file next to the identity
+ * database, so a leak of one store says nothing about the other. A PostgreSQL deployment keeps the
+ * same server for now: the deployment follow-up is a dedicated role or schema, which is a
+ * deployment decision rather than something to guess here.
+ */
+function resolveTaskCredentialDatabaseUrl(input) {
+    const configured = input.configuredUrl?.trim();
+    if (configured) {
+        return configured;
+    }
+    const identity = input.identityDatabaseUrl.trim();
+    if (!identity) {
+        throw new Error('task_credential_database_unconfigured');
+    }
+    if ((0, db_1.isSqliteUrl)(identity)) {
+        const filename = identity.replace(/^sqlite:(\/\/)?/u, '');
+        if (filename.startsWith(':memory:')) {
+            // One in-memory deployment cannot host two independent files; tests get their own URL.
+            return identity;
+        }
+        return `sqlite:${node_path_1.default.join(node_path_1.default.dirname(filename), 'tasks.sqlite')}`;
+    }
+    return identity;
+}
+/** Opens (once per URL) the task-layer database and makes sure its table exists. */
+function getTaskCredentialDatabase(url) {
+    const cached = databaseCache.get(url);
+    if (cached) {
+        return cached;
+    }
+    if ((0, db_1.isSqliteUrl)(url)) {
+        const filename = url.replace(/^sqlite:(\/\/)?/u, '');
+        const isMemory = filename === ':memory:' || filename.startsWith(':memory:');
+        const runtime = (0, SqliteRuntime_1.getSqliteRuntime)();
+        const sqlite = runtime.openDatabase(isMemory ? ':memory:' : filename);
+        if (!isMemory) {
+            sqlite.pragma('journal_mode = WAL');
+            sqlite.pragma('busy_timeout = 5000');
+            sqlite.pragma('synchronous = NORMAL');
+        }
+        const db = runtime.createDrizzleDatabase(sqlite);
+        void (0, TaskCredentialSchema_1.ensureTaskCredentialTables)(db).catch((error) => {
+            (0, global_logger_factory_1.getLoggerFor)('TaskCredentialDatabase').error(`Task credential table unavailable: ${String(error)}`);
+        });
+        const handle = { db, schema: TaskCredentialSchema_1.taskCredentialSchema.sqlite };
+        databaseCache.set(url, handle);
+        return handle;
+    }
+    const db = (0, node_postgres_1.drizzle)((0, PostgresPoolManager_1.getSharedPool)({ connectionString: url }));
+    void (0, TaskCredentialSchema_1.ensureTaskCredentialTables)(db).catch((error) => {
+        (0, global_logger_factory_1.getLoggerFor)('TaskCredentialDatabase').error(`Task credential table unavailable: ${String(error)}`);
+    });
+    const handle = { db, schema: TaskCredentialSchema_1.taskCredentialSchema.pg };
+    databaseCache.set(url, handle);
+    return handle;
+}
+/** Test helper: forget cached handles so a fresh database can be opened at the same URL. */
+function resetTaskCredentialDatabases() {
+    databaseCache.clear();
+}
+//# sourceMappingURL=TaskCredentialDatabase.js.map

package/dist/api/tasks/TaskCredentialSchema.d.ts

@@ -0,0 +1,471 @@
+/**
+ * Task-layer credential records: the runtime's own copy of a user's CSS client credentials.
+ *
+ * This table belongs to the task layer, not to the API: the API only ever uses a credential the
+ * caller brought with that request, while background execution needs one on file when nobody is
+ * present. Keeping it in its own database (local mode: its own SQLite file) is what makes that
+ * boundary real instead of a naming convention.
+ *
+ * `sealed_secret` is encrypted with the deployment key (decision 6), and the row records which
+ * key sealed it so rotation keeps old rows decryptable.
+ */
+export declare const taskCredentialsSqlite: import("drizzle-orm/sqlite-core").SQLiteTableWithColumns<{
+    name: "task_credential";
+    schema: undefined;
+    columns: {
+        credentialId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "credential_id";
+            tableName: "task_credential";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        ownerWebId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "owner_web_id";
+            tableName: "task_credential";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        issuer: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "issuer";
+            tableName: "task_credential";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        clientId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "client_id";
+            tableName: "task_credential";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        sealedSecret: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "sealed_secret";
+            tableName: "task_credential";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        sealedSecretKeyId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "sealed_secret_key_id";
+            tableName: "task_credential";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        credentialVersion: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "credential_version";
+            tableName: "task_credential";
+            dataType: "number";
+            columnType: "SQLiteInteger";
+            data: number;
+            driverParam: number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        status: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "status";
+            tableName: "task_credential";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        createdAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "created_at";
+            tableName: "task_credential";
+            dataType: "number";
+            columnType: "SQLiteInteger";
+            data: number;
+            driverParam: number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        rotatedAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "rotated_at";
+            tableName: "task_credential";
+            dataType: "number";
+            columnType: "SQLiteInteger";
+            data: number;
+            driverParam: number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        lastUsedAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "last_used_at";
+            tableName: "task_credential";
+            dataType: "number";
+            columnType: "SQLiteInteger";
+            data: number;
+            driverParam: number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        expiresAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "expires_at";
+            tableName: "task_credential";
+            dataType: "number";
+            columnType: "SQLiteInteger";
+            data: number;
+            driverParam: number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "sqlite";
+}>;
+export declare const taskCredentialsPg: any;
+export declare const taskCredentialSchema: {
+    sqlite: {
+        taskCredentials: import("drizzle-orm/sqlite-core").SQLiteTableWithColumns<{
+            name: "task_credential";
+            schema: undefined;
+            columns: {
+                credentialId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+                    name: "credential_id";
+                    tableName: "task_credential";
+                    dataType: "string";
+                    columnType: "SQLiteText";
+                    data: string;
+                    driverParam: string;
+                    notNull: true;
+                    hasDefault: false;
+                    isPrimaryKey: true;
+                    isAutoincrement: false;
+                    hasRuntimeDefault: false;
+                    enumValues: [string, ...string[]];
+                    baseColumn: never;
+                    identity: undefined;
+                    generated: undefined;
+                }, {}, {
+                    length: number | undefined;
+                }>;
+                ownerWebId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+                    name: "owner_web_id";
+                    tableName: "task_credential";
+                    dataType: "string";
+                    columnType: "SQLiteText";
+                    data: string;
+                    driverParam: string;
+                    notNull: true;
+                    hasDefault: false;
+                    isPrimaryKey: false;
+                    isAutoincrement: false;
+                    hasRuntimeDefault: false;
+                    enumValues: [string, ...string[]];
+                    baseColumn: never;
+                    identity: undefined;
+                    generated: undefined;
+                }, {}, {
+                    length: number | undefined;
+                }>;
+                issuer: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+                    name: "issuer";
+                    tableName: "task_credential";
+                    dataType: "string";
+                    columnType: "SQLiteText";
+                    data: string;
+                    driverParam: string;
+                    notNull: true;
+                    hasDefault: false;
+                    isPrimaryKey: false;
+                    isAutoincrement: false;
+                    hasRuntimeDefault: false;
+                    enumValues: [string, ...string[]];
+                    baseColumn: never;
+                    identity: undefined;
+                    generated: undefined;
+                }, {}, {
+                    length: number | undefined;
+                }>;
+                clientId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+                    name: "client_id";
+                    tableName: "task_credential";
+                    dataType: "string";
+                    columnType: "SQLiteText";
+                    data: string;
+                    driverParam: string;
+                    notNull: true;
+                    hasDefault: false;
+                    isPrimaryKey: false;
+                    isAutoincrement: false;
+                    hasRuntimeDefault: false;
+                    enumValues: [string, ...string[]];
+                    baseColumn: never;
+                    identity: undefined;
+                    generated: undefined;
+                }, {}, {
+                    length: number | undefined;
+                }>;
+                sealedSecret: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+                    name: "sealed_secret";
+                    tableName: "task_credential";
+                    dataType: "string";
+                    columnType: "SQLiteText";
+                    data: string;
+                    driverParam: string;
+                    notNull: true;
+                    hasDefault: false;
+                    isPrimaryKey: false;
+                    isAutoincrement: false;
+                    hasRuntimeDefault: false;
+                    enumValues: [string, ...string[]];
+                    baseColumn: never;
+                    identity: undefined;
+                    generated: undefined;
+                }, {}, {
+                    length: number | undefined;
+                }>;
+                sealedSecretKeyId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+                    name: "sealed_secret_key_id";
+                    tableName: "task_credential";
+                    dataType: "string";
+                    columnType: "SQLiteText";
+                    data: string;
+                    driverParam: string;
+                    notNull: true;
+                    hasDefault: false;
+                    isPrimaryKey: false;
+                    isAutoincrement: false;
+                    hasRuntimeDefault: false;
+                    enumValues: [string, ...string[]];
+                    baseColumn: never;
+                    identity: undefined;
+                    generated: undefined;
+                }, {}, {
+                    length: number | undefined;
+                }>;
+                credentialVersion: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+                    name: "credential_version";
+                    tableName: "task_credential";
+                    dataType: "number";
+                    columnType: "SQLiteInteger";
+                    data: number;
+                    driverParam: number;
+                    notNull: true;
+                    hasDefault: true;
+                    isPrimaryKey: false;
+                    isAutoincrement: false;
+                    hasRuntimeDefault: false;
+                    enumValues: undefined;
+                    baseColumn: never;
+                    identity: undefined;
+                    generated: undefined;
+                }, {}, {}>;
+                status: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+                    name: "status";
+                    tableName: "task_credential";
+                    dataType: "string";
+                    columnType: "SQLiteText";
+                    data: string;
+                    driverParam: string;
+                    notNull: true;
+                    hasDefault: false;
+                    isPrimaryKey: false;
+                    isAutoincrement: false;
+                    hasRuntimeDefault: false;
+                    enumValues: [string, ...string[]];
+                    baseColumn: never;
+                    identity: undefined;
+                    generated: undefined;
+                }, {}, {
+                    length: number | undefined;
+                }>;
+                createdAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+                    name: "created_at";
+                    tableName: "task_credential";
+                    dataType: "number";
+                    columnType: "SQLiteInteger";
+                    data: number;
+                    driverParam: number;
+                    notNull: true;
+                    hasDefault: false;
+                    isPrimaryKey: false;
+                    isAutoincrement: false;
+                    hasRuntimeDefault: false;
+                    enumValues: undefined;
+                    baseColumn: never;
+                    identity: undefined;
+                    generated: undefined;
+                }, {}, {}>;
+                rotatedAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+                    name: "rotated_at";
+                    tableName: "task_credential";
+                    dataType: "number";
+                    columnType: "SQLiteInteger";
+                    data: number;
+                    driverParam: number;
+                    notNull: false;
+                    hasDefault: false;
+                    isPrimaryKey: false;
+                    isAutoincrement: false;
+                    hasRuntimeDefault: false;
+                    enumValues: undefined;
+                    baseColumn: never;
+                    identity: undefined;
+                    generated: undefined;
+                }, {}, {}>;
+                lastUsedAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+                    name: "last_used_at";
+                    tableName: "task_credential";
+                    dataType: "number";
+                    columnType: "SQLiteInteger";
+                    data: number;
+                    driverParam: number;
+                    notNull: false;
+                    hasDefault: false;
+                    isPrimaryKey: false;
+                    isAutoincrement: false;
+                    hasRuntimeDefault: false;
+                    enumValues: undefined;
+                    baseColumn: never;
+                    identity: undefined;
+                    generated: undefined;
+                }, {}, {}>;
+                expiresAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+                    name: "expires_at";
+                    tableName: "task_credential";
+                    dataType: "number";
+                    columnType: "SQLiteInteger";
+                    data: number;
+                    driverParam: number;
+                    notNull: false;
+                    hasDefault: false;
+                    isPrimaryKey: false;
+                    isAutoincrement: false;
+                    hasRuntimeDefault: false;
+                    enumValues: undefined;
+                    baseColumn: never;
+                    identity: undefined;
+                    generated: undefined;
+                }, {}, {}>;
+            };
+            dialect: "sqlite";
+        }>;
+    };
+    pg: {
+        taskCredentials: any;
+    };
+};
+/** Creates the task-layer table on a fresh database; existing rows are left untouched. */
+export declare function ensureTaskCredentialTables(db: any): Promise<void>;